Privilege escalation via unchecked BootROM write

An unchecked write in Unisoc SC9863A, T310, T610, and T618 BootROM allows physically proximate attackers to execute privileged code. The cmd_start handler accepts an attacker-selected target address, and cmd_recv_data copies attacker-controlled bytes to that pointer without validating the destination. Brief physical access to recovery mode over USB or UART is sufficient to overwrite a function pointer or stack return address and run code with BootROM privileges.